CVE-2026-94395

A flaw was found in SafeNet Authentication Client SAC. A stack-based buffer overflow vulnerability in the SIS token engine allows an attacker connecting a malicious physical or software-emulated smart card to execute arbitrary code with the privileges of the affected process. This flaw occurs...

CVE-2026-58128

A flaw was found in Alan: Health Insurance for Android. This vulnerability allows a local malicious application on the same device to achieve arbitrary code execution or tamper with application data by overwriting sensitive files in the application's private storage. An attacker can exploit this...

Mintinstall-object-injection

TR Linux mint yazılım yöneticisi v 7.9.5/9 yanlış yapılandırmadan dolayı obje enjeksiyonu ve keyfi kod çalıştırmamıza neden olmaktadır. EN Linux mint software manager v 7.9.5/9 causes us to execute object injection and arbitrary code due to incorrect configuration mintinsall TR Mint yazılım...

CVE-2026-122160

A flaw was found in AIlice. The Hugging Face model wrapper fails to properly restrict or validate model paths within the LoadModelPEFT function. A remote attacker could exploit this vulnerability by supplying a manipulated model path, causing the application to load and execute untrusted external...

WordPress Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection vulnerability

Authenticated Shop Manager+ PHP Code Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin CTX Feed versions = 8.0.26...

CVE-2025-49844

CVE-2025-49844 Original uv POC: https://github.com/saneki/cve-2025-49844 PoC that provides reverse shell. Before Start pip3 install -r requirements.txt Help python3 CVE-2025-49844.py -h usage: CVE-2025-49844.py -h -H HOST -P PORT -a PASSWORD -l HOST -p PORT CVE-2025-49844 proof-of-concept — Redis...

CVE-2026-89960

A flaw was found in the Linux kernel's s390/vfio-ap component. This vulnerability occurs when an error during the setup of a virtual machine KVM leaves a pointer to a cryptographic function in an invalid state. A malicious guest virtual machine could exploit this by executing a specific...

CVE-2026-89774

A flaw was found in the Linux kernel's Bluetooth Synchronous Connection-Oriented SCO module. This Use-After-Free UAF vulnerability occurs due to a race condition where the system attempts to use a memory region after it has been freed. A remote attacker could exploit this flaw by initiating a...

CVE-2026-97209

A flaw was found in Elixir's Mix build tool. During partitioned dependency compilation, Mix exchanges configuration data through a predictable folder in the shared system temporary directory without properly verifying directory ownership. A local attacker on the same host can exploit this flaw by...

php2shell-619-poc

CVE-2026-109619 — PHP Session Upload Progress OOM → RCE Explo...

Eaton-UPS-Companion-Exploit

Overview The Eaton UPS Companion software checks for an update every single week over an insecure HTTP connection and evals the content of whatever is at the update URL. This allows an attacker to craft a JavaScript function which uses the low-level OS operations that already exist in the backend...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

CVE-2026-118905

A flaw was found in nvm. Improper input sanitization when filtering version strings allows injected commands to be processed by the underlying stream editor sed. A local attacker can exploit this vulnerability by enticing a user to process an untrusted version string—such as through a directory...

CVE-2026-112302

A flaw was found in kiwilan php-archive. The ZIP archive extraction process fails to properly validate destination file paths, leading to a path traversal vulnerability. A remote attacker can provide a specially crafted ZIP archive containing directory traversal sequences to exploit this flaw...

CVE-2026-111059

A flaw was found in Mercury. The application fails to properly sanitize raw HTML when converting user-controlled Markdown into web components. A remote attacker could exploit this vulnerability by providing malicious Markdown containing active HTML elements or scripts, resulting in Cross-Site...

CVE-2026-119193

A flaw was found in PHPUnit. On multi-user systems sharing a common temporary directory, the framework reuses a predictable temporary folder during code coverage tests without verifying ownership or permissions. A local attacker can pre-create the directory and substitute test files, leading to...

React2Shell

React2Shell – Advanced Discovery & Exploitation Framework An advanced React Server Components RSC vulnerability scanner and exploiter for CVE-2025-55182 and CVE-2025-66478 affecting Next.js applications. This tool expands upon the original React2Shell research and proof-of-concept by introducing...

CVE-2023-39115

CVE-2023-39115 Description: Campcodes Online Matrimonial Website System Script v3.3 is vulnerable to an arbitrary file upload vulnerability, potentially allowing attackers to execute arbitrary code on the targeted server. The vulnerability arises from insufficient validation of uploaded files,...

machscope

machscope machscope is a terminal-native macOS explorer that turns processes, launchd jobs, Mach services, bundles, signatures, entitlements, and Mach-O linkage into one interrogable graph. It exists to answer a simple question brutally well: What is this process, service, binary, or bundle reall...

CVE-2024-50493

CVE-2024-50493 Automatic Translation = 1.0.4 - Unauthenticated Arbitrary File Upload Description: The Automatic Translation plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for...